From owner-freebsd-fs@FreeBSD.ORG Thu Jun 22 15:30:08 2006 Return-Path: X-Original-To: freebsd-fs@freebsd.org Delivered-To: freebsd-fs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 156EE16A47C for ; Thu, 22 Jun 2006 15:30:08 +0000 (UTC) (envelope-from pedro@ambientworks.net) Received: from protection.cx (protection.cx [209.242.20.18]) by mx1.FreeBSD.org (Postfix) with ESMTP id 157F243D49 for ; Thu, 22 Jun 2006 15:29:59 +0000 (GMT) (envelope-from pedro@ambientworks.net) Received: by protection.cx (Postfix, from userid 1001) id 9AC034C; Thu, 22 Jun 2006 10:35:04 -0500 (CDT) Date: Thu, 22 Jun 2006 12:35:04 -0300 From: Pedro Martelletto To: freebsd-fs@freebsd.org Message-ID: <20060622153504.GB835@static.protection.cx> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: plug memory leaks and fix nested loops in udf_find_partmaps() X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Jun 2006 15:30:08 -0000 currently, there are two nested 'for' loops in udf_find_partmaps() which use the same control variable (i), as well as memory leaks in two error paths, which the following diff should fix. -p. Index: udf_vfsops.c =================================================================== RCS file: /home/ncvs/src/sys/fs/udf/udf_vfsops.c,v retrieving revision 1.41 diff -u -p -r1.41 udf_vfsops.c --- udf_vfsops.c 26 May 2006 01:21:51 -0000 1.41 +++ udf_vfsops.c 22 Jun 2006 15:08:25 -0000 @@ -728,7 +728,7 @@ udf_find_partmaps(struct udf_mnt *udfmp, struct regid *pmap_id; struct buf *bp; unsigned char regid_id[UDF_REGID_ID_SIZE + 1]; - int i, ptype, psize, error; + int i, k, ptype, psize, error; for (i = 0; i < le32toh(lvd->n_pm); i++) { pmap = (union udf_pmap *)&lvd->maps[i * UDF_PMAP_SIZE]; @@ -776,6 +776,7 @@ udf_find_partmaps(struct udf_mnt *udfmp, brelse(bp); printf("Failed to read Sparing Table at sector %d\n", le32toh(pms->st_loc[0])); + FREE(udfmp->s_table, M_UDFMOUNT); return (error); } bcopy(bp->b_data, udfmp->s_table, le32toh(pms->st_size)); @@ -783,15 +784,16 @@ udf_find_partmaps(struct udf_mnt *udfmp, if (udf_checktag(&udfmp->s_table->tag, 0)) { printf("Invalid sparing table found\n"); + FREE(udfmp->s_table, M_UDFMOUNT); return (EINVAL); } /* See how many valid entries there are here. The list is * supposed to be sorted. 0xfffffff0 and higher are not valid */ - for (i = 0; i < le16toh(udfmp->s_table->rt_l); i++) { - udfmp->s_table_entries = i; - if (le32toh(udfmp->s_table->entries[i].org) >= + for (k = 0; k < le16toh(udfmp->s_table->rt_l); k++) { + udfmp->s_table_entries = k; + if (le32toh(udfmp->s_table->entries[k].org) >= 0xfffffff0) break; }